chore: harden public SDK release

[JJasonSun]

Summary

• bound webhook example request bodies and handle interrupted uploads
• serialize npm mutations and enforce stable release/dist-tag policy
• remove the test-service hostname from current public docs and clarify MIT coverage for 0.6.0 and 0.7.0

Checklist

• I kept this change within the documented server SDK scope.
• I did not add browser/client-side patterns that expose CALL-E API keys.
• I did not include private collaboration links or unconfirmed public repository references.
• I updated tests, examples, or docs when behavior changed.
• I updated the changelog when the change affects package users.
• I ran the relevant local checks.

Local checks

npx --yes pnpm@8.10.2 run validate
npx --yes pnpm@8.10.2 audit --prod --audit-level high